🐛 Add missing widget API routes that redirected to SPA catch-all by clubanderson · Pull Request #4145 · kubestellar/console

clubanderson · 2026-04-01T13:22:10Z

Summary

Widget endpoints /api/mcp/workloads, /api/mcp/security, /api/mcp/storage, /api/mcp/network, and /api/mcp/namespaces had no backend route registrations, causing requests to fall through to the SPA catch-all and return HTTP 307 redirects instead of JSON data
Added a new GetWorkloads handler that aggregates Deployments, StatefulSets, and DaemonSets (non-streaming counterpart of GetWorkloadsStream)
Registered 4 additional route aliases mapping widget paths to existing handlers: /mcp/security -> CheckSecurityIssues, /mcp/storage -> GetPVCs, /mcp/network -> GetNetworkPolicies, /mcp/namespaces -> ListNamespaces

Test plan

go build ./pkg/... passes
go test ./pkg/api/handlers/... passes (all handler tests)
npx tsc --noEmit passes (frontend type check)
Verify each endpoint returns JSON instead of redirect: curl -s http://localhost:8080/api/mcp/workloads, /security, /storage, /network, /namespaces
Verify exported Ubersicht widgets using these endpoints fetch data correctly

Widget endpoints /api/mcp/workloads, /api/mcp/security, /api/mcp/storage, /api/mcp/network, and /api/mcp/namespaces were referenced by the widget registry but had no backend route registrations. Requests to these paths fell through to the SPA catch-all and returned HTTP 307 redirects instead of JSON data, breaking exported Ubersicht widgets. - Add GetWorkloads handler aggregating Deployments/StatefulSets/DaemonSets - Register /mcp/security as alias for CheckSecurityIssues - Register /mcp/storage as alias for GetPVCs - Register /mcp/network as alias for GetNetworkPolicies - Register /mcp/namespaces as alias for ListNamespaces Fixes #4140, #4141, #4142 Signed-off-by: Andrew Anderson <andy@clubanderson.com>

kubestellar-prow · 2026-04-01T13:22:16Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign mikespreitzer for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

netlify · 2026-04-01T13:22:17Z

✅ Deploy Preview for kubestellarconsole canceled.

Name	Link
🔨 Latest commit	`0b1513d`
🔍 Latest deploy log	https://app.netlify.com/projects/kubestellarconsole/deploys/69cd1c06297aa300086a29ab

Copilot

Pull request overview

Adds explicit backend route registrations for MCP widget endpoints so they return JSON instead of falling through to the SPA catch-all redirect, and introduces a non-streaming workloads aggregate handler.

Changes:

Register widget-friendly /api/mcp/* route aliases for workloads, security, storage, network, and namespaces.
Add GetWorkloads handler to return aggregated Deployments/StatefulSets/DaemonSets data (non-streaming).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
pkg/api/server.go	Registers missing widget API aliases to prevent SPA catch-all redirects.
pkg/api/handlers/mcp.go	Adds `GetWorkloads` non-streaming handler returning aggregated workload data.

Copilot · 2026-04-01T13:28:35Z

pkg/api/server.go

+	// paths.  Without explicit routes they fall through to the SPA catch-all
+	// which returns index.html (HTTP 307), breaking exported widgets.


The comment mixes behaviors: an HTTP 307 is a redirect response, not ‘returns index.html’. To avoid confusion for future maintainers, reword to reflect the actual behavior (e.g., ‘redirects (HTTP 307) to the SPA / index route’ or, if applicable, ‘serves index.html (200)’).

Suggested change

// paths. Without explicit routes they fall through to the SPA catch-all

// which returns index.html (HTTP 307), breaking exported widgets.

// paths. Without explicit routes they fall through to the SPA catch-all,

// which redirects (HTTP 307) to the SPA / index route, breaking exported widgets.

Copilot · 2026-04-01T13:28:35Z

pkg/api/handlers/mcp.go

+	workloads := list.Items
+	if workloads == nil {
+		workloads = make([]v1alpha1.Workload, 0)


Potential nil-pointer dereference: if ListWorkloads returns (nil, nil) on success, list.Items will panic. Add a guard for list == nil and default to an empty slice before accessing Items.

Suggested change

workloads := list.Items

if workloads == nil {

workloads = make([]v1alpha1.Workload, 0)

var workloads []v1alpha1.Workload

if list == nil || list.Items == nil {

workloads = make([]v1alpha1.Workload, 0)

} else {

workloads = list.Items

github-actions · 2026-04-01T13:44:49Z

👋 Hey @clubanderson — thanks for opening this PR!

🤖 This project is developed exclusively using AI coding assistants.

Please do not attempt to code anything for this project manually.
All contributions should be authored using an AI coding tool such as:

Claude Code (Opus 4.5 / 4.6) — recommended

GitHub Copilot

Cursor

Other AI coding assistants

This ensures consistency in code style, architecture patterns, test coverage,
and commit quality across the entire codebase.

This is an automated message.

github-actions · 2026-04-01T13:46:27Z

Thank you for your contribution! Your PR has been merged.

Check out what's new:

KubeStellar Console — Live multi-cluster dashboard
Marketplace — Community extensions
Knowledge Base — Troubleshooting and how-tos

Stay connected: Slack #kubestellar-dev | Multi-Cluster Survey

clubanderson · 2026-04-01T13:55:19Z

🔄 Auto-Applying Copilot Code Review

Copilot code review found 2 code suggestion(s) and 0 general comment(s).

@copilot Please apply all of the following code review suggestions:

pkg/api/server.go (line 742): // paths. Without explicit routes they fall through to the SPA catch-all, // w...
pkg/api/handlers/mcp.go (line 2746): var workloads []v1alpha1.Workload if list == nil || list.Items == nil { workl...

Push all fixes in a single commit. Run cd web && npm run build && npm run lint before committing.

Auto-generated by copilot-review-apply workflow.

- server.go: Restrict query param token to WebSocket upgrades only, update stale comments for validateToken and matchOrigin (#4099) - useMissions.tsx: Guard against double-cancel with timeout map check (#4143) - mcp.go: Nil guard on ListWorkloads result before accessing Items (#4145) - workload.go: Remove redundant len(nodes)>0 guard after early continue (#4146) - workload_scaling_test.go: Rename test to ZeroNodeCluster (not UnreachableCluster) (#4146) Signed-off-by: Andrew Anderson <andy@clubanderson.com>

…4158) - server.go: Restrict query param token to WebSocket upgrades only, update stale comments for validateToken and matchOrigin (#4099) - useMissions.tsx: Guard against double-cancel with timeout map check (#4143) - mcp.go: Nil guard on ListWorkloads result before accessing Items (#4145) - workload.go: Remove redundant len(nodes)>0 guard after early continue (#4146) - workload_scaling_test.go: Rename test to ZeroNodeCluster (not UnreachableCluster) (#4146) Signed-off-by: Andrew Anderson <andy@clubanderson.com>

Copilot AI review requested due to automatic review settings April 1, 2026 13:22

kubestellar-prow bot added the dco-signoff: yes Indicates the PR's author has signed the DCO. label Apr 1, 2026

clubanderson merged commit cfaa4cd into main Apr 1, 2026
15 of 16 checks passed

kubestellar-prow bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 1, 2026

kubestellar-prow bot deleted the fix/widget-api-redirects branch April 1, 2026 13:22

This was referenced Apr 1, 2026

Security widget API path redirects instead of returning data #4141

Closed

Storage/network/namespaces widget API paths redirect instead of returning data #4142

Closed

Copilot AI reviewed Apr 1, 2026

View reviewed changes

clubanderson assigned Copilot Apr 1, 2026

Copilot started reviewing on behalf of clubanderson April 1, 2026 14:06 View session

clubanderson mentioned this pull request Apr 1, 2026

🐛 Address Copilot review comments: token security, double-cancel guard, nil checks #4158

Merged

2 tasks

clubanderson mentioned this pull request Apr 1, 2026

🐛 Address Copilot review comments from 8 merged PRs #4161

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Add missing widget API routes that redirected to SPA catch-all#4145

🐛 Add missing widget API routes that redirected to SPA catch-all#4145
clubanderson merged 1 commit intomainfrom
fix/widget-api-redirects

clubanderson commented Apr 1, 2026

Uh oh!

kubestellar-prow bot commented Apr 1, 2026

Uh oh!

netlify bot commented Apr 1, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

Copilot AI Apr 1, 2026

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

clubanderson commented Apr 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// paths. Without explicit routes they fall through to the SPA catch-all
		// which returns index.html (HTTP 307), breaking exported widgets.

Conversation

clubanderson commented Apr 1, 2026

Summary

Test plan

Uh oh!

kubestellar-prow bot commented Apr 1, 2026

Uh oh!

netlify bot commented Apr 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kubestellarconsole canceled.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

github-actions bot commented Apr 1, 2026

Uh oh!

clubanderson commented Apr 1, 2026

🔄 Auto-Applying Copilot Code Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

netlify bot commented Apr 1, 2026 •

edited

Loading